Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Sora tutorial skill with broad activation wording but no code, persistence, credential access, or hidden behavior.
Installers should know this skill may appear for broad Sora questions; review whether that routing is acceptable, but there is no evidence it performs sensitive actions or changes the environment.
The trigger string includes very broad terms such as "Sora" and "Sora2", which are likely to appear in ordinary conversation unrelated to this specific skill. That can cause unintended activation, leading the agent to inject this skill's guidance into contexts where it was not requested and reducing the reliability of skill routing.
The activation condition "用户需要Sora相关帮助" is ambiguous and effectively matches a wide range of normal requests about Sora. This broad scope increases the chance of accidental invocation and context pollution, where the skill may override more appropriate behaviors or responses.
